Conducting the Audit and Collecting Evidence

Introduction

An audit becomes valuable not when an audit plan is written, but when the auditor obtains sufficient, reliable evidence and evaluates it fairly against defined criteria. Conducting an audit therefore requires more than asking questions or checking documents. It involves managing professional relationships, observing real work, tracing transactions, selecting appropriate samples, testing controls, recording evidence, and reaching conclusions that can withstand scrutiny.

In quality management systems, audit evidence may demonstrate conformity, reveal weaknesses, identify risks, or show that a process is ineffective despite apparently complete documentation. The auditor must remain objective while creating an atmosphere in which personnel can explain how work is actually performed. This chapter presents a practical and systematic approach to opening and closing meetings, interviewing personnel, observing activities, reviewing records, sampling evidence, verifying process effectiveness, maintaining audit trails, and handling difficult situations.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Conduct effective opening and closing meetings.
2. Interview personnel using appropriate questioning and listening techniques.
3. Observe activities and distinguish documented requirements from actual practice.
4. Trace transactions, products, services, and records through a process.
5. Review and evaluate documented information and objective evidence.
6. Apply sound sampling principles without overstating conclusions.
7. Verify both conformity and process effectiveness.
8. Maintain a clear audit trail from criteria to evidence and findings.
9. Handle resistance, conflict, unavailable records, and other difficult situations professionally.
10. Communicate audit findings accurately, ethically, and constructively.

1. The Audit as an Evidence-Gathering Process

An audit compares objective evidence with audit criteria. Criteria may include ISO requirements, organizational procedures, customer requirements, statutory obligations, contractual commitments, and internally established performance standards. Evidence includes records, statements of fact, observations, measurements, system outputs, and other verifiable information.

A useful evidence chain is:

Audit criterion → Evidence sought → Evidence obtained → Evaluation → Finding → Conclusion

For example, if the criterion requires competence to be evaluated, the auditor may examine competence requirements, training records, authorization lists, interview responses, and observed performance. A training certificate alone may demonstrate attendance, but it does not necessarily demonstrate competence or effective application.

Evidence should be:

• Relevant: directly related to the audit objective and criterion.
• Verifiable: capable of confirmation by another competent auditor.
• Sufficient: adequate in amount to support the conclusion.
• Appropriate: reliable and suitable for the decision being made.
• Traceable: linked to a process, person, transaction, record, or time period.

The auditor should distinguish evidence from opinion. “The operator seemed unsure” is an impression. “The operator could not identify the current inspection instruction and used an obsolete form” is a potentially verifiable observation.

2. Managing the Opening Meeting

The opening meeting establishes the conditions for an orderly and cooperative audit. It should be proportionate to the audit’s size and complexity. A short process audit may require only a brief discussion, while a certification audit or integrated management-system audit requires a more formal meeting.

2.1 Purpose and content

The lead auditor normally confirms:

• introductions, roles, and responsibilities;
• audit objectives, scope, and criteria;
• audit methods, including interviews, observation, sampling, and remote techniques;
• audit timetable and areas to be visited;
• communication arrangements and escorts;
• safety, security, confidentiality, and access requirements;
• methods for reporting concerns or requesting clarification;
• arrangements for daily updates and the closing meeting;
• limitations, exclusions, or changes to the audit plan.

The opening meeting should not become a lecture on the standard. Its purpose is to create a shared understanding of how the audit will be conducted.

2.2 Professional conduct at the opening meeting

Auditors should be respectful, neutral, and clear. They should avoid implying that a finding has already been decided. Statements such as “We are here to understand how your system works and to compare evidence with the agreed criteria” establish a constructive tone.

The auditor should also explain that employees are not being examined for personal blame. The focus is the adequacy and effectiveness of processes. However, this does not mean that deliberate falsification, unsafe conduct, or concealment of information can be ignored.

3. Interviewing Personnel

Interviews are a principal source of audit evidence, especially for understanding responsibilities, decision-making, risk controls, and practical implementation. A strong interview is a structured professional conversation, not an interrogation.

3.1 Planning the interview

Before interviewing, the auditor should identify:

• the process being examined;
• the person’s role in that process;
• the criteria relevant to the role;
• evidence that may corroborate the responses;
• open questions needed to understand actual practice.

Interviewees should normally be selected across relevant roles and levels. Managers can explain objectives and resources; supervisors can explain controls; operators can explain actual work; support staff can explain records, systems, and interfaces.

3.2 Questioning techniques

Useful questions include:

• “Please describe what happens when a customer complaint is received.”
• “How do you know which document or specification is current?”
• “What happens when the inspection result is outside the acceptance criteria?”
• “Can you show me an example of a recently completed record?”
• “How do you know that this corrective action was effective?”

Open questions encourage explanation. Closed questions are useful for confirming specific facts, but excessive use may produce rehearsed answers. Leading questions should be avoided because they influence the response.

The auditor should listen actively, allow reasonable pauses, and distinguish what the interviewee knows from what the auditor assumes. Important statements should be tested through observation or records. If an operator says, “We always check the first item,” the auditor may ask to see the applicable instruction and a completed first-piece inspection record.

3.3 Interview ethics

Auditors should protect confidentiality, avoid humiliating interviewees, and not disclose one employee’s comments unnecessarily to another. Notes should be factual and secure. An interview should not be conducted in a way that exposes an employee to retaliation. Where sensitive matters arise, the auditor should follow the organization’s escalation and safeguarding arrangements.

4. Observation of Activities

Observation provides evidence of what actually occurs. It is particularly important because procedures may describe an ideal process while work practices reveal variation, workarounds, or undocumented controls.

The auditor should observe without unnecessarily disrupting operations. Before drawing conclusions, the auditor should understand the normal sequence of work, relevant hazards, and the difference between a temporary condition and routine practice.

Observation may concern:

• identification and traceability;
• equipment settings and calibration status;
• handling, storage, and preservation;
• use of approved instructions;
• inspection and testing;
• hygiene, safety, or environmental controls;
• segregation of nonconforming outputs;
• access controls and information security;
• handovers and communication between departments.

A useful observation record identifies the activity, location, time, relevant requirement, facts observed, and any supporting record. The auditor should avoid vague statements such as “poor housekeeping.” A stronger record states: “In the finished-goods area, three containers lacked status identification, and personnel could not establish whether they were released or awaiting inspection.”

Observation is a sample of performance at a particular time. It should not automatically be generalized to every shift or location without additional evidence.

5. Tracing Transactions and Processes

Tracing follows a product, service, order, complaint, record, or decision through connected process steps. It tests whether process interfaces operate as intended and whether records are complete and consistent.

5.1 Forward and backward tracing

Forward tracing begins with an input and follows it toward the final output. For example, an auditor may follow a purchase order through receipt, inspection, storage, production, release, and delivery.

Backward tracing begins with an output or problem and works toward its origin. For example, a delivered product may be traced back to the batch record, raw materials, equipment, inspection results, and supplier information.

Both directions are useful. Forward tracing tests process flow and control points; backward tracing tests traceability, investigation, and the reliability of records.

5.2 The audit trail

An audit trail is the logical connection between the audit criterion, the evidence examined, and the conclusion reached. A strong trail permits another competent person to reconstruct the auditor’s reasoning.

For a sampled order, the audit trail might include:

1. customer order and specified requirements;
2. contract or requirement review;
3. production or service planning;
4. material or resource identification;
5. inspection and test results;
6. deviations or nonconformities;
7. approval or release authorization;
8. delivery evidence and customer feedback.

Broken links, contradictory dates, missing approvals, unexplained alterations, or inconsistent quantities may indicate a control weakness. They do not automatically prove intentional misconduct; the auditor must investigate objectively.

6. Reviewing Records and Documented Information

Records provide evidence that an activity occurred and may show its result. The auditor should assess records for authenticity, completeness, accuracy, legibility, timeliness, authorization, and protection from unintended alteration.

Important questions include:

• Is the record linked to a unique item, batch, order, or case?
• Is the date and responsible person identifiable?
• Are acceptance criteria defined and results recorded?
• Are corrections controlled and explainable?
• Is the record retained for the required period?
• Can the record be retrieved when needed?
• Does the record agree with other evidence?

Electronic records require additional attention to access rights, audit logs, version control, electronic approval, backup, and system-generated timestamps. A system report may appear authoritative but still depend on incorrect data entry or inappropriate user permissions.

The existence of a procedure is not evidence that the procedure is implemented. Conversely, an effective control may exist even when the procedure is poorly written. The auditor should evaluate both documented arrangements and actual results, while reporting documentation weaknesses where they create risk or prevent consistent control.

7. Sampling Audit Evidence

Audits rarely examine every transaction. Sampling is therefore necessary, but it introduces the risk that the sample does not represent the wider population.

A sound sample is selected according to the audit objective and risk. Relevant factors include:

• population size and nature;
• process risk and significance;
• history of problems;
• frequency of activity;
• changes in personnel, equipment, software, or suppliers;
• stratification by shift, location, product, or customer;
• time available and the consequences of an incorrect conclusion.

Common approaches include:

The auditor must not claim that a sample proves universal conformity. A finding should state the evidence examined and describe the basis for extending concern beyond the individual item. If one record is missing, the conclusion may be limited to that record unless corroborating evidence indicates a systemic problem.

Sampling should be documented sufficiently to explain the population, selection method, sample size or rationale, items examined, and results. In high-risk contexts, the audit team may increase coverage or use data analytics to examine the full population for unusual patterns.

8. Verifying Process Effectiveness

Conformity asks whether requirements are met. Effectiveness asks whether the process achieves intended results. These are related but different judgments.

A process may be documented and consistently followed yet fail to achieve its objective. For example, a complaint procedure may require every complaint to be logged, but customer dissatisfaction may remain high because root causes are not addressed. Conversely, a process may achieve acceptable results through informal methods, but its lack of control may create unacceptable dependence on individual knowledge.

Effectiveness can be evaluated through evidence such as:

• achievement of process objectives;
• defect, rework, scrap, or error trends;
• on-time delivery or service performance;
• customer complaints and satisfaction data;
• corrective-action recurrence;
• process capability or inspection results;
• completion and effectiveness of improvement actions;
• resilience during abnormal conditions.

The auditor should ask: What is the process intended to achieve? What indicators demonstrate achievement? What happens when results deteriorate? Who reviews the data, and what decisions follow?

Auditors should avoid confusing activity with effectiveness. Training completion, meetings held, and forms completed are activity measures. They may be useful, but they do not necessarily demonstrate improved competence, controlled risk, or better customer outcomes.

9. Developing and Recording Audit Findings

A finding should be based on a comparison between criteria and evidence. A clear finding generally contains:

1. Requirement: what was expected.
2. Evidence: what was observed or examined.
3. Gap or conformity: how the evidence compares with the requirement.
4. Significance: the risk or consequence, where relevant.

For example: “The internal procedure requires completed inspection records to identify the inspector and acceptance result. In four of ten sampled records from March, the inspector was not identifiable and the acceptance result was blank. This prevents verification that the required inspection was completed and approved.”

The auditor should avoid exaggeration, unsupported causes, and language assigning blame. The auditor may identify risk, but should not prescribe a solution unless the audit terms specifically require consultancy. Root-cause analysis and corrective action are normally the responsibility of the audited organization.

Findings should be discussed with the responsible representative during the audit where possible. This allows factual errors to be corrected without compromising independence. Discussion is not negotiation over whether an accurate finding should be removed.

10. Managing Difficult Audit Situations

10.1 Resistance or defensiveness

Resistance may arise from fear, previous negative experiences, misunderstanding, or concern about consequences. The auditor should return to the criteria and evidence, use neutral language, and ask the person to explain the process. Avoid arguing about motives.

10.2 Unavailable records

If records cannot be produced, the auditor should establish whether they are missing, inaccessible, destroyed, misclassified, or retained by another party. The absence itself may be relevant if the organization is required to retain or retrieve the information. The auditor should record what was requested, when it was requested, and what response was received.

10.3 Conflicting explanations

Conflicting accounts should be treated as a signal for further verification, not as proof that someone is dishonest. The auditor can compare interviews with system data, observation, approvals, timestamps, and independent records.

10.4 Scope pressure and time constraints

When time is limited, the auditor should prioritize high-risk processes, significant changes, previous findings, and critical controls. The auditor must not silently omit planned coverage and then present the audit as complete. Scope limitations should be communicated and recorded.

10.5 Discovery of serious risk

If the auditor observes imminent danger, unlawful activity, product-safety risk, or potential evidence destruction, the matter should be escalated immediately according to the audit program and organizational rules. Normal reporting arrangements must not delay necessary protective action.

11. The Closing Meeting

The closing meeting presents the audit conclusion and findings. It should be controlled, factual, and respectful. The lead auditor normally explains:

• the audit scope and activities completed;
• the overall conclusion;
• positive practices and strengths, where relevant;
• nonconformities and other findings;
• limitations affecting confidence in the conclusion;
• required correction or corrective-action arrangements;
• reporting, response, and follow-up expectations.

The auditor should make clear that conclusions are based on sampled evidence. Findings should be read or summarized accurately, and the audited organization should have an opportunity to identify factual errors. Disagreement does not automatically invalidate a finding; unresolved disagreements should be recorded and handled through the defined appeal or review process.

A good closing meeting avoids surprises. Significant issues should normally have been communicated during the audit, subject to the need to protect confidentiality or complete verification.

12. Technology and AI in Evidence Collection

Digital tools can improve audit efficiency. Auditors may use electronic checklists, secure document portals, process-mining tools, dashboards, remote video observation, data analytics, and automated anomaly detection. These tools can help identify duplicate transactions, unusual approval times, missing fields, or recurring failures across a large population.

However, technology does not replace auditor judgment. Data may be incomplete, incorrectly configured, or interpreted without process context. Remote observation may limit visibility of informal practices, physical conditions, or off-camera activities. AI-generated summaries can omit uncertainty, misclassify evidence, or reproduce bias in the underlying data.

Use of AI should therefore include:

• verification of generated outputs against source evidence;
• protection of confidential and personal information;
• clear human accountability for findings;
• controlled access and retention;
• awareness of automation bias;
• disclosure where required by organizational or regulatory rules.

13. Illustrative Case: Audit of a Medical-Device Packaging Process

Background

A fictional manufacturer, MedSure Devices, experienced an increase in customer complaints alleging that sterile-package labels were difficult to read. The internal audit examined document control, label printing, inspection, release, and complaint feedback.

Problem and evidence collection

The auditor began with an opening meeting and then interviewed the packaging supervisor and two operators. The supervisor stated that only the current label template was used. During observation, one workstation displayed a locally saved template with a different revision number. The operator explained that it was used when the network was slow.

The auditor traced three finished orders backward. Two orders had the correct template revision. The third had been produced using the older local file. The final inspection record showed that the label had been checked, but the record did not identify the template revision. A complaint record described a similar readability problem.

Analysis

The evidence indicated more than an isolated document discrepancy. The process permitted uncontrolled local copies, and the inspection record did not provide enough information to establish which template had been used. The inspection activity therefore could not fully demonstrate effective control of label information.

Approach and outcome

The finding was presented using the requirement, evidence, and gap structure. The organization immediately removed local copies, restored controlled access to the approved template, and introduced a system check requiring the template revision to be recorded. It also reviewed recent production for possible impact and investigated the complaint trend.

The auditor did not prescribe the exact software solution. Instead, the organization selected controls appropriate to its system. Follow-up evidence later demonstrated that the revised control was implemented and that sampled records identified the template revision.

Learning points

1. A controlled procedure does not guarantee controlled practice.
2. Tracing a transaction can reveal weaknesses at process interfaces.
3. A completed inspection record may be insufficient if it lacks traceability.
4. A finding should address the control weakness without assigning personal blame.
5. Effectiveness requires follow-up evidence, not merely a documented action.

Challenges and Limitations

Audit evidence is always subject to limitations. Sampling may miss infrequent failures; interviews may be influenced by memory or fear; records may be incomplete; observation may alter behavior; and remote audits may restrict access. Auditors should communicate these limitations and avoid false certainty.

Another limitation is the danger of reducing auditing to checklist completion. Checklists support consistency, but they can cause auditors to overlook emerging risks, process interactions, and unintended consequences. Professional auditing requires curiosity, critical thinking, and the ability to follow evidence beyond the planned question.

Best-Practice Principles

• Plan evidence collection around risk and process objectives.
• Use multiple evidence sources before making significant conclusions.
• Record facts precisely and distinguish facts from interpretation.
• Follow transactions across departmental interfaces.
• Test effectiveness, not merely the existence of documents.
• Explain sampling limitations.
• Protect confidentiality and treat people with dignity.
• Escalate serious risks promptly.
• Discuss potential findings during the audit where practical.
• Maintain an audit trail that another competent reviewer can follow.
• Use technology as an aid to judgment, not a substitute for it.

Chapter Summary

Conducting an audit is a disciplined process of obtaining and evaluating evidence against defined criteria. Effective auditors manage opening and closing meetings, interview personnel respectfully, observe real work, trace transactions, and review both physical and electronic records. They use sampling carefully and avoid generalizing beyond the evidence. They distinguish conformity from effectiveness by examining whether processes achieve intended results. Clear findings connect requirements, evidence, and gaps without exaggeration or blame. Difficult situations require neutrality, escalation when necessary, and accurate documentation of limitations. Digital tools and AI can strengthen evidence collection, but human judgment, confidentiality, and accountability remain essential.

Key Terms

Audit evidence: Verifiable information used to evaluate audit criteria.

Audit trail: Logical connection between criteria, evidence, findings, and conclusions.

Audit criteria: Requirements used as the reference for comparison.

Opening meeting: Formal or informal meeting that establishes audit arrangements.

Closing meeting: Meeting at which audit conclusions, findings, and follow-up arrangements are presented.

Objective evidence: Information based on fact that can be verified.

Interview: Structured discussion used to obtain information from personnel.

Observation: Direct examination of an activity, condition, or process.

Forward tracing: Following an input through successive process stages to an output.

Backward tracing: Following an output or problem back toward its source.

Sampling: Examining a selected portion of a population to support an audit conclusion.

Stratified sampling: Sampling separate subgroups within a population.

Conformity: Fulfilment of a specified requirement.

Effectiveness: Extent to which planned activities achieve intended results.

Nonconformity: Failure to fulfil a requirement.

Documented information: Information required to be controlled and maintained by an organization.

Correction: Action taken to eliminate a detected nonconformity.

Corrective action: Action taken to eliminate the cause of a nonconformity and prevent recurrence.

Scope limitation: Restriction that prevents complete examination of planned audit areas.

Automation bias: Excessive reliance on automated or AI-generated outputs.

Review Questions

Short Answer Questions

1. What characteristics make audit evidence reliable?
2. Why should interviews be corroborated with observation or records?
3. Distinguish forward tracing from backward tracing.
4. Why is a completed form not always evidence of process effectiveness?
5. What information should normally be communicated at a closing meeting?

Long Answer Questions

1. Explain how an auditor should plan and conduct an evidence-based interview.
2. Discuss the principles and limitations of sampling audit evidence.
3. Explain how an audit trail supports the credibility of audit findings.
4. Compare conformity and effectiveness, using a quality-management example.
5. Describe professional methods for handling resistance, missing records, and conflicting explanations.

Analytical / Application Questions

1. During an audit, three of twelve sampled inspection records lack acceptance results. Develop a reasoned approach for determining whether this is an isolated error or evidence of a systemic control failure.
2. An operator uses an obsolete work instruction because the approved electronic system is slow. Identify the evidence you would collect, the risks involved, and the structure of a potential finding.
3. A process achieves its delivery target but has increasing customer complaints and repeated corrective actions. Evaluate whether the process can be considered effective and explain what additional evidence is required.

Multiple Choice Questions with Answers

Question 1

Which statement best describes objective audit evidence?

A. The auditor’s personal impression of employee commitment

B. Information based on fact that can be verified

C. A manager’s unsupported belief that a process works

D. A predicted result from an audit checklist

Correct Answer: B. Information based on fact that can be verified

Question 2

What is the principal purpose of an opening meeting?

A. To announce findings before evidence is collected

B. To train employees on the applicable ISO standard

C. To establish the audit arrangements and shared expectations

D. To negotiate removal of previous findings

Correct Answer: C. To establish the audit arrangements and shared expectations

Question 3

Which question is most suitable for understanding actual process practice?

A. You always follow the procedure, don’t you?

B. Is the procedure effective?

C. Please describe what happens when an inspection result is outside acceptance criteria.

D. Can I assume this record is complete?

Correct Answer: C. Please describe what happens when an inspection result is outside acceptance criteria.

Question 4

Backward tracing begins by examining which item?

A. An output, delivery, or identified problem

B. The audit timetable

C. The auditor’s competence record

D. The opening-meeting attendance list

Correct Answer: A. An output, delivery, or identified problem

Question 5

Which statement about audit sampling is correct?

A. A sample always proves conformity of the entire population

B. Sampling should be related to audit objectives and risk

C. Only the newest records may be sampled

D. Judgmental sampling eliminates all selection bias

Correct Answer: B. Sampling should be related to audit objectives and risk

Question 6

Which finding is most professionally written?

A. The operator was careless and poorly trained

B. Housekeeping is bad everywhere

C. Four sampled records lacked an identifiable inspector and acceptance result, although the procedure requires both

D. Management does not care about quality

Correct Answer: C. Four sampled records lacked an identifiable inspector and acceptance result, although the procedure requires both

Question 7

What distinguishes effectiveness from conformity?

A. Effectiveness concerns whether intended results are achieved

B. Effectiveness concerns only whether documents exist

C. Conformity is based only on interviews

D. Conformity never requires objective evidence

Correct Answer: A. Effectiveness concerns whether intended results are achieved

Question 8

What should an auditor do when serious imminent safety risk is discovered?

A. Wait until the final report is issued

B. Ignore it if it is outside the checklist

C. Escalate it promptly according to defined arrangements

D. Delete the evidence to protect confidentiality

Correct Answer: C. Escalate it promptly according to defined arrangements

Question 9

Which practice strengthens an audit trail?

A. Recording conclusions without identifying sampled evidence

B. Linking the criterion, evidence examined, evaluation, and finding

C. Using only verbal explanations

D. Replacing evidence with the auditor’s recommendation

Correct Answer: B. Linking the criterion, evidence examined, evaluation, and finding

Question 10

What is an important safeguard when using AI-generated audit summaries?

A. Accepting the summary without reviewing source records

B. Allowing the AI system to issue findings independently

C. Verifying outputs against source evidence and retaining human accountability

D. Uploading confidential records to any available system

Correct Answer: C. Verifying outputs against source evidence and retaining human accountability